Techniques for fingerprinting and aggregating a virtual private cloud (VPC) flow log stream are provided. Each VPC flow log event in the VPC flow log is first determined to be a request event or a response event. A fingerprint is then generated for each VPC flow log event. The fingerprint for a VPC flow log event is generated based on the determination whether the VPC flow log event is a request event or a response event and by concatenating and encoding data contained in a set of data fields corresponding to the VPC flow log event. Based on the fingerprint generated for each VPC flow log event, related events can be detected and aggregated to form an aggregated event. Information stored with each aggregated event can then be used to better monitor the VPC.
Legal claims defining the scope of protection, as filed with the USPTO.
6. The method of claim 1, wherein the identifier comprises a fingerprint, wherein the fingerprint is based on hashing one or more of: a client interface identifier of the first data flow log event, a source address of the first data flow log event, a destination address of the first data flow log event, a communication protocol identifier of the first data flow log event, an action identifier of the first data flow log event, the first port value, and the second port value.
7. The method of claim 1, wherein a first one of the first port value and the second port value is a source port value, wherein a second one of the first port value and the second port value is a destination port value.
13. The computer-readable storage medium of claim 8, wherein the identifier comprises a fingerprint, wherein the fingerprint is based on hashing one or more of: a client interface identifier of the first data flow log event, a source address of the first data flow log event, a destination address of the first data flow log event, a communication protocol identifier of the first data flow log event, an action identifier of the first data flow log event, the first port value, and the second port value.
14. The computer-readable storage medium of claim 8, wherein a first one of the first port value and the second port value is a source port value, wherein a second one of the first port value and the second port value is a destination port value.
20. The computing apparatus of claim 15, wherein the identifier comprises a fingerprint, wherein the fingerprint is based on hashing one or more of: a client interface identifier of the first data flow log event, a source address of the first data flow log event, a destination address of the first data flow log event, a communication protocol identifier of the first data flow log event, an action identifier of the first data flow log event, the first port value, and the second port value.
Cooperative Patent Classification codes for this invention. Click any code to explore related patents in that topic.
November 28, 2022
February 20, 2024
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.